Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tlsfuzzer/python-ecdsa

              master @ bff40c6
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Algorithm Confusion: 1 prior fix. Scrutinize any change in this area.

src/ecdsa/keys.py: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Implementation Issue: Encoding public keys and shared secrets using the curve order instead of the field prime produces incorrect output for curves where these differ, breaking interoperability and potentially enabling downstream validation failures.

Public Key Validation: Loading public keys without verifying the point is on the curve allows acceptance of invalid points, which can lead to invalid signatures being accepted or enabling small-subgroup attacks.

Timing Side-Channel: Nonce bit-length variability in ECDSA signing leaks information about the private key through timing, enabling key recovery attacks. The fix ensures constant-time nonce generation.